Contract analysis

ARTICLE I — DEFINITIONS For purposes of this Protocol, the following terms shall have the meanings set forth below:

Section 1.1 — "CRH Data." "CRH Data" means all documents, files, records, data, information, and materials (in whatever form or medium, whether physical, electronic, or digital) that (a) were created, developed, stored, or maintained by or on behalf of CRH, (b) were accessed, obtained, copied, downloaded, transferred, or otherwise acquired by any Individual Defendant during his or her employment with CRH, and (c) con

Section 1.2 — "Covered Systems." "Covered Systems" means all personal devices (including personal laptops, desktop computers, tablets, smartphones, and any other computing devices), personal email accounts (including accounts hosted by Northgate Software, Cascade Health IT, Ridgeline Technologies, Greaves Systems, or any other email service provider), personal cloud storage accounts (including, but not limited to, pe

Section 1.3 — "Verdana Systems." "Verdana Systems" means all devices, servers, networks, cloud environments (including, without limitation, Ridgeway Industries, Crestline Systems, Aldermere Technologies, and any private cloud infrastructure), email systems, collaboration platforms (including, without limitation, Meridian Solutions, Northgate Data Systems, Ashbury Data Systems, and similar platforms), shared drives, d

Section 1.4 — "Exfiltrated Data." "Exfiltrated Data" means the approximately 14,327 files comprising approximately 2.8 gigabytes of data identified in the forensic report of Pinnacle Forensics LLC dated March 12, 2025 (the "Initial Forensic Report"), as having been downloaded from CRH's Aldermere Systems and Pinnacle Health IT environments to personal cloud storage accounts between January 10, 2025, and February 4, 2

Section 1.5 — "Forensic Auditor." "Forensic Auditor" means Pinnacle Forensics LLC, located at 8700 Georgia Avenue, Suite 300, Silver Spring, Maryland 20910, engagement lead Dr. Rajiv Anand, or such other qualified forensic firm as the parties may mutually agree upon in writing or as the Court may appoint.

Section 1.6 — "Effective Date." "Effective Date" means the date of execution of the Agreement, which the parties have targeted to be April 14, 2025.

Section 1.7 — "Data Return/Destruction Deadline." "Data Return/Destruction Deadline" means the date that is ten (10) business days following the Effective Date.

Section 1.8 — "Certification Deadline." "Certification Deadline" means the date that is twelve (12) business days following the Effective Date (i.e., two (2) business days after the Data Return/Destruction Deadline).

ARTICLE II — OBLIGATIONS OF INDIVIDUAL DEFENDANTS

Section 2.1 — Identification of CRH Data. Within three (3) business days of the Effective Date, each Individual Defendant shall provide to CRH's counsel, Calderwood & Harkness LLP, 1301 K Street NW, Suite 1200, Washington, DC 20005, Attention: Bernard Crawford and James Underwood, a sworn written inventory (the "Individual Inventory"), executed under penalty of perjury, identifying the following: (a) All Covered Syst

Section 2.2 — Return of CRH Data. Each Individual Defendant shall, on or before the Data Return/Destruction Deadline: (a) Return to CRH all physical documents, media, and tangible items containing or constituting CRH Data. All such physical materials shall be delivered to Calderwood & Harkness LLP at the address set forth in Section 2.1 above, via hand delivery, overnight courier (with tracking and signature confirma

Section 2.3 — Destruction of CRH Data. Following confirmed receipt of returned data by CRH (or upon CRH's written direction to destroy in lieu of return, which CRH may issue in its sole discretion), each Individual Defendant shall, on or before the Data Return/Destruction Deadline: (a) Permanently delete all CRH Data from all Covered Systems using deletion and sanitization methods that meet or exceed the standards se

Section 2.4 — Prohibition on Retention. No Individual Defendant shall retain, in any form or medium (whether physical, electronic, digital, handwritten, or otherwise), any CRH Data after the Data Return/Destruction Deadline. This prohibition extends to all copies, duplicates, extracts, summaries, notes, screenshots, photographs, and any other reproductions of CRH Data, regardless of the format in which such materials

Section 2.5 — Individual Certifications. Each Individual Defendant shall, on or before the Certification Deadline, deliver to CRH's counsel a signed certification under penalty of perjury, substantially in the form attached as Annex B-1 to this Exhibit (the "Individual Certification"), attesting to the following: (a) That such Individual Defendant has complied in full with Sections 2.1 through 2.4 of this Protocol; (

ARTICLE III — OBLIGATIONS OF VERDANA COMMERCE GROUP, INC.

Section 3.1 — Internal Search and Identification. Within five (5) business days of the Effective Date, Verdana shall conduct a thorough, diligent, and good-faith search of all Verdana Systems to identify any and all CRH Data that may have been introduced, uploaded, stored, cached, transmitted, accessed, or otherwise present on any Verdana System, whether as a result of actions taken by any Individual Defendant or by

Section 3.2 — Destruction on Verdana Systems. Verdana shall, on or before the Data Return/Destruction Deadline, permanently delete all CRH Data identified on Verdana Systems using deletion and sanitization methods that meet or exceed the standards set forth in NIST SP 800-88 or equivalent standards as approved by the Forensic Auditor. Verdana shall maintain a detailed log of all destruction activities, including the

Section 3.3 — Quarantine Pending Forensic Audit. Verdana shall, immediately upon the Effective Date, quarantine (i.e., isolate and restrict all access to) any and all CRH Data identified on Verdana Systems, pending completion of the destruction process described in Section 3.2 and verification by the Forensic Auditor as described in Article IV. Quarantine measures shall include, at a minimum, the following: (a) Remov

Section 3.4 — Verdana Certification. Verdana shall, within five (5) business days following completion of the Independent Forensic Audit described in Article IV and receipt of the Forensic Audit Report, deliver to CRH's counsel a certification signed by an authorized officer of Verdana, substantially in the form attached as Annex B-2 to this Exhibit (the "Verdana Certification"), attesting to the following: (a) That

Section 3.5 — Ongoing Restrictions. For a period of twelve (12) months following the Effective Date (the "Monitoring Period"), Verdana shall maintain reasonable technical and administrative controls to prevent the re-introduction of CRH Data into Verdana Systems. Such controls shall include, at a minimum: (a) Enhanced monitoring of file uploads, downloads, and transfers by any Individual Defendant employed by or enga

ARTICLE IV — INDEPENDENT FORENSIC AUDIT

Section 4.1 — Appointment of Forensic Auditor. The parties agree that Pinnacle Forensics LLC, located at 8700 Georgia Avenue, Suite 300, Silver Spring, Maryland 20910, with Dr. Rajiv Anand serving as engagement lead, shall serve as the independent Forensic Auditor for purposes of verifying compliance with this Protocol. Pinnacle Forensics LLC was originally retained by Calderwood & Harkness LLP on behalf of CRH on Fe

Section 4.2 — Scope of Forensic Audit. The Forensic Auditor shall conduct an independent forensic audit (the "Independent Forensic Audit") encompassing the following: (a) Individual Defendant Systems. All Covered Systems identified by each Individual Defendant in his or her Individual Inventory provided pursuant to Section 2.1, to the extent the Individual Defendant consents or is directed by the Agreement, the Conse

Section 4.3 — Verdana Cooperation and Access. Verdana shall provide the Forensic Auditor with full, prompt, and unrestricted access to all Verdana Systems (including, without limitation, production systems, development and staging environments, backup systems, disaster recovery infrastructure, and archival storage) as reasonably necessary to conduct the Independent Forensic Audit. Such access shall include the provis

Section 4.4 — Individual Defendant Cooperation. Each Individual Defendant shall provide the Forensic Auditor with reasonable access to his or her Covered Systems for purposes of verification of compliance with this Protocol, subject to reasonable scheduling accommodations that do not unreasonably delay the completion of the Independent Forensic Audit. Each Individual Defendant shall cooperate fully with the Forensic

Section 4.5 — Timeline for Forensic Audit. The Forensic Auditor shall commence the Independent Forensic Audit within five (5) business days following the Data Return/Destruction Deadline. The Forensic Auditor shall use commercially reasonable efforts to complete the audit within thirty (30) calendar days of commencement. If the Forensic Auditor determines that additional time is required to complete the audit due to

Section 4.6 — Cost of Forensic Audit. The costs and expenses of the Independent Forensic Audit shall be allocated as follows: (a) Verdana Systems. All costs and expenses of the Independent Forensic Audit as applied to the examination of Verdana Systems shall be borne exclusively by Verdana, subject to a cap of One Hundred Seventy-Five Thousand Dollars ($175,000). If the Forensic Auditor projects that the costs of the

Section 4.7 — Remediation of Non-Compliance. In the event that the Forensic Audit Report identifies any CRH Data that was not properly returned or destroyed in accordance with this Protocol, the following remediation procedures shall apply: (a) The responsible party (whether an Individual Defendant or Verdana, as applicable) shall, immediately and without further delay, complete the return or destruction of such CRH

ARTICLE V — CONFIDENTIALITY OF PROTOCOL AND REPORTS

Section 5.1 — Confidential Treatment. This Protocol, the Individual Inventories, the Verdana Search Report, the Individual Certifications, the Verdana Certification, the Forensic Audit Report, the Supplemental Forensic Report (if any), and all other documents, communications, and materials produced, generated, or exchanged pursuant to this Protocol (collectively, the "Protocol Materials") shall be treated as strictly

Section 5.2 — Court Filing Under Seal. To the extent any Protocol Materials are filed with the Delaware Court of Chancery in connection with any proceeding arising under or related to this Protocol or the Agreement, such materials shall be filed under seal and shall be subject to the Stipulated Protective Order entered by Vice Chancellor Zhao on March 28, 2025, or such other protective order as the Court may enter. T

ARTICLE VI — REPRESENTATIONS AND WARRANTIES

Section 6.1 — Individual Defendants' Representations. Each Individual Defendant hereby represents and warrants to CRH, as of the Effective Date and as of the Certification Deadline, as follows: (a) The Individual Inventory provided by such Individual Defendant pursuant to Section 2.1 is complete and accurate in all material respects, and such Individual Defendant has not knowingly omitted any Covered System or any ca

Section 6.2 — Verdana's Representations. Verdana hereby represents and warrants to CRH, as of the Effective Date and as of the date of delivery of the Verdana Certification, as follows: (a) Verdana has not, other than through the receipt of CRH Data from the Individual Defendants as may be disclosed in the Individual Inventories and the Verdana Search Report, independently obtained CRH Data through any other means, i

ARTICLE VII — CONSEQUENCES OF NON-COMPLIANCE

Section 7.1 — Breach. A material breach of this Protocol by any Individual Defendant or by Verdana shall constitute a material breach of the Agreement and shall entitle CRH to all remedies available under the Agreement, at law, and in equity, without limitation, including the following: (a) Enforcement of this Protocol and the Agreement through the Consent Order entered by the Delaware Court of Chancery in C.A. No. 2

Section 7.2 — Liquidated Damages. In the event of a material breach of this Protocol, the liquidated damages provisions set forth in Section 7.4 of the Agreement shall apply, and the breaching party shall be liable for the liquidated damages amounts specified therein. The parties acknowledge and agree that such liquidated damages are a reasonable estimate of the harm that CRH would suffer as a result of a breach of t

ARTICLE VIII — GENERAL PROVISIONS

Section 8.1 — Governing Law. This Protocol shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to any conflict-of-laws principles that would require or permit the application of the laws of any other jurisdiction.

Section 8.2 — Jurisdiction. The Delaware Court of Chancery shall have exclusive jurisdiction for the interpretation and enforcement of this Protocol, and the parties hereby consent to the personal jurisdiction of the Delaware Court of Chancery for such purposes. The Delaware Court of Chancery shall retain continuing jurisdiction over the parties and the subject matter of this Protocol pursuant to the Consent Order en

Section 8.3 — Notices. All notices, certifications, inventories, reports, and other communications required or permitted to be given or delivered under this Protocol shall be in writing and shall be deemed duly given (a) upon personal delivery, (b) one (1) business day after deposit with a nationally recognized overnight courier service (with tracking and signature confirmation), or (c) upon confirmed transmission by

Section 8.4 — Amendments. This Protocol may not be amended, modified, supplemented, or waived except by a written instrument signed by CRH, each Individual Defendant, and Verdana. If the Consent Order has been entered by the Delaware Court of Chancery at the time of any proposed amendment, such amendment shall not be effective unless and until it has been approved by the Court.

Section 8.5 — Integration. This Protocol is an integral part of the Agreement and is incorporated therein by reference as Exhibit B. This Protocol, together with the Agreement and the other exhibits and annexes thereto, constitutes the entire agreement among the parties with respect to the subject matter hereof and supersedes all prior negotiations, representations, warranties, commitments, offers, contracts, and wri

1. Identification of Covered Systems. I have identified all Covered Systems (as defined in the Protocol) on which CRH Data (as defined in the Protocol) resided or at any time resided since January 1, 2025, as set forth in my sworn Individual Inventory dated ____, which was delivered to CRH's counsel in accordance with Section 2.1 of the Protocol. The Individual Inventory is complete and accurate in all material respe

2. Return and Destruction of CRH Data. I have returned to CRH or permanently destroyed all CRH Data that was in my possession, custody, or control, in accordance with the methods and standards specified in the Protocol, including compliance with NIST SP 800-88, Revision 1, "Guidelines for Media Sanitization," or equivalent standards approved by the Forensic Auditor. All return and destruction activities were complete

3. No Retention. I have not retained any CRH Data in any form or medium, whether physical, electronic, digital, handwritten, or otherwise, and no CRH Data remains in my possession, custody, or control, whether directly or through any agent, representative, family member, or other person acting on my behalf. Exception (if applicable): If any CRH Data has been retained pursuant to the legal-obligation exception set for

4. No Unauthorized Transmission. I have not transmitted, shared, forwarded, or otherwise made CRH Data available to any person or entity other than as fully disclosed in my sworn Individual Inventory delivered pursuant to Section 2.1 of the Protocol.

5. Deletion Methods Employed. The specific deletion and sanitization methods I employed for each Covered System are as follows: (Attach additional pages as necessary.) I declare under penalty of perjury under the laws of the State of Delaware and the United States of America that the foregoing is true and correct to the best of my knowledge, information, and belief. Executed on this _ day of ___, 2025. ______________

8. Kira Johansson Each Individual Defendant shall execute a separate original of this certification and deliver it to CRH's counsel on or before the Certification Deadline. ANNEX B-2 FORM OF VERDANA CORPORATE CERTIFICATION OF COMPLIANCE WITH DATA RETURN AND DESTRUCTION PROTOCOL CERTIFICATION OF COMPLIANCE WITH DATA RETURN AND DESTRUCTION PROTOCOL VERDANA COMMERCE GROUP, INC. The undersigned, a duly authorized officer

1. Search and Identification. Verdana has conducted a thorough and diligent search of all Verdana Systems (as defined in the Protocol), under the supervision of Verdana's General Counsel, Helen Tsoi, and has identified all CRH Data (as defined in the Protocol) residing on or accessible through any Verdana System. The results of such search were set forth in the Verdana Search Report delivered to CRH's counsel and to

2. Destruction of CRH Data. Verdana has permanently deleted all CRH Data from all Verdana Systems using deletion and sanitization methods that meet or exceed the standards set forth in NIST SP 800-88, Revision 1, "Guidelines for Media Sanitization," or equivalent standards approved by the Forensic Auditor. With respect to backup media operating on automated rotation schedules, destruction of CRH Data on such media ha

3. Quarantine and Non-Access. Verdana quarantined all identified CRH Data on Verdana Systems immediately upon the Effective Date, in accordance with Section 3.3 of the Protocol, and subsequently destroyed all such quarantined data. During the quarantine period, no Verdana employee, officer, director, consultant, advisor, or agent accessed, reviewed, copied, or used any quarantined CRH Data.